CVE-2026-48804: CWE-770: Allocation of Resources Without Limits or Throttling in miguelgrinberg python-socketio
python-socketio is a Python implementation of the Socket.IO realtime client and server. The python-socketio server stores binary `EVENT` and `ACK` messages in memory while it waits to receive their binary attachments. Once all the attachments are received, these messages are then processed. Prior to version 5.16.4, an attacker can submit a binary message and intentionally omit sending one or more of its attachments to cause the message along with the partial list of received attachments to stay in memory for a long time. Version 5.16.4 takes the following measures to address this issue: Binary packets are only accepted from authenticated clients and, when a client disconnects, the server checks if there is a partial binary message being held for the client and deletes it.
AI Analysis
Technical Summary
python-socketio server implementations prior to version 5.16.2 store binary EVENT and ACK messages in memory while waiting for all their binary attachments. An attacker can exploit this by sending a binary message and deliberately omitting one or more attachments, causing the server to retain the incomplete message and partial attachments in memory indefinitely. This accumulation can lead to denial of service due to resource exhaustion. Version 5.16.4 mitigates this by accepting binary packets only from authenticated clients and deleting partial binary messages when a client disconnects.
Potential Impact
An unauthenticated remote attacker can cause the python-socketio server to consume excessive memory by sending incomplete binary messages, resulting in denial of service. The vulnerability does not impact confidentiality or integrity but affects availability.
Mitigation Recommendations
Upgrade python-socketio to version 5.16.4 or later, which restricts binary packets to authenticated clients and removes partial binary messages on client disconnect. This official fix effectively mitigates the vulnerability.
CVE-2026-48804: CWE-770: Allocation of Resources Without Limits or Throttling in miguelgrinberg python-socketio
Description
python-socketio is a Python implementation of the Socket.IO realtime client and server. The python-socketio server stores binary `EVENT` and `ACK` messages in memory while it waits to receive their binary attachments. Once all the attachments are received, these messages are then processed. Prior to version 5.16.4, an attacker can submit a binary message and intentionally omit sending one or more of its attachments to cause the message along with the partial list of received attachments to stay in memory for a long time. Version 5.16.4 takes the following measures to address this issue: Binary packets are only accepted from authenticated clients and, when a client disconnects, the server checks if there is a partial binary message being held for the client and deletes it.
CVSS v3.1
Score 7.5high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
python-socketio server implementations prior to version 5.16.2 store binary EVENT and ACK messages in memory while waiting for all their binary attachments. An attacker can exploit this by sending a binary message and deliberately omitting one or more attachments, causing the server to retain the incomplete message and partial attachments in memory indefinitely. This accumulation can lead to denial of service due to resource exhaustion. Version 5.16.4 mitigates this by accepting binary packets only from authenticated clients and deleting partial binary messages when a client disconnects.
Potential Impact
An unauthenticated remote attacker can cause the python-socketio server to consume excessive memory by sending incomplete binary messages, resulting in denial of service. The vulnerability does not impact confidentiality or integrity but affects availability.
Mitigation Recommendations
Upgrade python-socketio to version 5.16.4 or later, which restricts binary packets to authenticated clients and removes partial binary messages on client disconnect. This official fix effectively mitigates the vulnerability.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-5w7q-77mv-v69f
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-48804"]
- Ecosystems
- ["PyPI"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a3ef76827e9c79719fee7af
Added to database: 06/26/2026, 22:04:24 UTC
Last enriched: 08/12/2026, 12:53:33 UTC
Last updated: 09/14/2026, 22:01:34 UTC
Views: 159
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.